Ethereal-users: Re: [Ethereal-users] Display filter for broadcast/multicast ethernet

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Sun, 10 Apr 2005 12:31:52 +0200
Guy Harris wrote:

>
> so "eth.dst[0:1] & 1" should test the low-order bit of the first byte
> of the destination address, and match packets where that bit is set.
>
> Given that, "!(eth.dst[0:1] & 1)" should test that bit and match
> packets where it's *not* set, so that should be a display filter to
> show only unicast packets.

Hi!

The length field is not required for a single byte, so "eth.dst[0] & 1"
should do the same job.

I've added some more filters to the Ethernet wiki page:
http://wiki.ethereal.com/Ethernet

Regards, ULFL